[bluez/bluez] ce408c: bap: Fix stack buffer overflow in BlueZ LE Audio B...

[hadess <noreply@github.com>]

  Branch: refs/heads/1152690
  Home:   https://github.com/bluez/bluez
  Commit: ce408cacdb61d3137360268227f5c4aa31fce899
      https://github.com/bluez/bluez/commit/ce408cacdb61d3137360268227f5c4aa31fce899
  Author: Bastien Nocera <hadess@hadess.net>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  bap: Fix stack buffer overflow in BlueZ LE Audio BASE parser

A stack buffer overflow (CWE-121) in bap_sink_match_allocation() in
src/shared/bap.c allows an attacker within BLE range to write ~195
attacker-controlled bytes past a 4-byte stack buffer in bluetoothd
with no pairing, no connection, and no user interaction. The BAP
profile auto-syncs to any device advertising the BCAAS UUID.

bap_sink_match_allocation() copies the value of an
Audio_Channel_Allocation LTV (type 0x03) into a 4-byte uint32_t stack
local using the LTV's attacker-controlled length byte as the memcpy
size, with no upper bound check:
	// src/shared/bap.c:7767
	memcpy(&location32, v, l);  // l attacker-controlled, no upper bound

A second identical instance exists in bap_sink_get_allocation() at line 2558.

Per Bluetooth Assigned Numbers, Audio_Channel_Allocation is a fixed 4-octet
bitfield; any other length is malformed.

https://github.com/bluez/bluez/security/advisories/GHSA-9683-2chf-hfw9

Co-Authored-by: @thaidn and @bronson-calif of Calif.io in collaboration with
  Claude and Anthropic Research.
Reported-by: @thaidn and @bronson-calif of Calif.io in collaboration with
  Claude and Anthropic Research.



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications